Japan Security Analyst Conference 2020
(Opening Talk)

Looking back on theincidents in 2019
JPCERT Coordination CenterIncident Response Group
January 17th, 2020
Takayoshi SHIIGI

1

Copyright ©2020 JPCERT/CC All rights reserved.

Two Major Attack Types

Targeted Widespread(Attack aimed to stealconfidentialinformation)

2

Copyright ©2020 JPCERT/CC All rights reserved.

(Attack aimed tosteal money)

Targeted Attack

3

Copyright ©2020 JPCERT/CC All rights reserved.

Targeted Attack Campaigns (confirmed by JPCERT/CC)

4

Copyright ©2020 JPCERT/CC All rights reserved.

Trends in Recent Targeted Attack

5

Leverage Cloudservices

Leverage Generictools• Microsoft Azure• Google Cloud etc.

• Open source tools• PoshC2• PowerShell Empire• QuasarRAT etc.
• OS commands

Copyright ©2020 JPCERT/CC All rights reserved.

Complex Malware• File less
• Modular architecture• Multiple stages

Tick

6

Copyright ©2020 JPCERT/CC All rights reserved.

Scan Activity

Observation of scan activities for exploiting the asset management software(Source: TSUBAME(Internet monitoring system): Jan, 2017～Dec, 2019)7

Copyright ©2020 JPCERT/CC All rights reserved.

Malware(NodeRAT)

8

Copyright ©2020 JPCERT/CC All rights reserved.

BlackTech

9

Copyright ©2020 JPCERT/CC All rights reserved.

TSCookie Loader & TSCookie

10

Copyright ©2020 JPCERT/CC All rights reserved.

Attack Exploiting
Specific Product(CVE-2019-9489)
11

Copyright ©2020 JPCERT/CC All rights reserved.

Attack Summary

C2
Initial attack
ExploitCVE-2019-9489

Lateral movement(Leveragelegitimate function)

PoshC2

AD ServerTarget organization
12

Virus Buster
Corp. Server

Copyright ©2020 JPCERT/CC All rights reserved.

Lateralmovement

QuasarRAT(APT10)

13

Copyright ©2020 JPCERT/CC All rights reserved.

Execution Flow
Service start

DLLLoader

14

Copyright ©2020 JPCERT/CC All rights reserved.

DATA
Encoded QuasarRATConfig Value

15

Copyright ©2020 JPCERT/CC All rights reserved.

Function

16

Copyright ©2020 JPCERT/CC All rights reserved.

Widespread Attack

17

Copyright ©2020 JPCERT/CC All rights reserved.

Attack Exploiting
Vulnerabilities in SSL
VPN Products
18

Copyright ©2020 JPCERT/CC All rights reserved.

Alert & Advisory19

Copyright ©2020 JPCERT/CC All rights reserved.

Vulnerable Pulse Secure VPN hosts in Japan (CVE-2019-11510)

20

Copyright ©2020 JPCERT/CC All rights reserved.

Emotet21

Copyright ©2020 JPCERT/CC All rights reserved.

Publication

22

Copyright ©2020 JPCERT/CC All rights reserved.

Malicious Mail Example
Mail

23

Copyright ©2020 JPCERT/CC All rights reserved.

Attachment

Analysis Tool

24

Copyright ©2020 JPCERT/CC All rights reserved.

Ghidrahttps://ghidra-sre.org/

25

https://github.com/NationalSecurityAgency/ghidra

Copyright ©2020 JPCERT/CC All rights reserved.

IDA: Undo

Ctrl+Z
26

Copyright ©2020 JPCERT/CC All rights reserved.

MalConfScan
https://github.com/JPCERTCC/MalConfScan27Copyright ©2020 JPCERT/CC All rights reserved.

How to Enjoy
JSAC 2020
28

Copyright ©2020 JPCERT/CC All rights reserved.

Sharing Technical Info about Incidents
Topic29

Session Title

AEvil Hidden in Shellcode: The Evolution of Malware DBGPRINT

A/DThreat Information on the APT Group Conducting "Operation
Bitter Biscuit"

B/A

The Implementation and Usage of Artifact Collection Tool andSimple Malware Analysis Sandbox for macOSB

Developing an Efficient Mac Forensic Tool

CIs It Wrong to Try to Find APT Techniques in Ransomware Attack?

D100 more behind cockroaches? or how to hunt IoCs with OSINT

D

Battle Against Ursnif Malspam Campaign targeting JapanDAn Overhead View of the Royal Road

Copyright ©2020 JPCERT/CC All rights reserved.

[A] Malware [C] Incident[B] Forensics [D] Threat trends, intelligenceNetworking

30

Copyright ©2020 JPCERT/CC All rights reserved.

Thank you!
31

Copyright ©2020 JPCERT/CC All rights reserved.